The User Registration PRO plugin for WordPress by WPEverest suffers from a CSRF vulnerability due to improper nonce validation in the account deletion function. This enables attackers to craft malicious requests that, if executed by an authenticated site administrator, can delete user accounts without their consent. The vulnerability affects all versions up to and including 5.1.3. The CVSS 3.1 base score is 4.3, reflecting a medium severity with network attack vector, no privileges required, user interaction needed, and limited impact on integrity only.

An attacker can cause an authenticated administrator to unknowingly delete user accounts, including other administrators, by tricking them into clicking a malicious link or performing an action that sends a forged request. This can disrupt user management and potentially impact site administration. There is no direct confidentiality or availability impact reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, administrators should exercise caution with links and actions performed while logged in, and consider restricting administrative access or using additional security plugins that provide CSRF protection.